{
 "id": "WPSEC-2026-3083",
 "url": "https://wpsec.com/vuln/WPSEC-2026-3083/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-3083/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-3083/index.md",
 "title": "PowerPack Lite for Beaver Builder <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Dual Button Module",
 "description": "The PowerPack Lite for Beaver Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Dual Button module's 'button_2_effect' setting in versions 1.2.5 up to, and including, 1.3.2 due to insufficient input sanitization and output escaping. The setting value is printed without escaping inside the class attribute of the second button's wrapper element. This makes it possible for authenticated attackers with contributor-level access and above who can edit Beaver Builder layouts to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
 "plugin": {
  "slug": "powerpack-addon-for-beaver-builder",
  "name": "PowerPack Lite for Beaver Builder",
  "full_name": "PowerPack Lite for Beaver Builder",
  "wordpress_org": "https://wordpress.org/plugins/powerpack-addon-for-beaver-builder/",
  "advisories_url": "https://wpsec.com/vuln/plugin/powerpack-addon-for-beaver-builder/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/powerpack-addon-for-beaver-builder"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "1.2.5",
    "from_inclusive": true,
    "to": "1.3.3",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 1.2.5 before 1.3.3"
  ]
 },
 "introduced_in": "1.2.5",
 "fixed_in": "1.3.3",
 "remediation": "Update to 1.3.3 or later.",
 "fix_released": "2026-11-12T15:11:31+00:00",
 "published": "2026-11-13T16:44:01+00:00",
 "updated": "2026-11-13T15:54:34.510791+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-3083/",
  "https://plugins.svn.wordpress.org/powerpack-addon-for-beaver-builder/tags/1.3.3/",
  "https://wordpress.org/plugins/powerpack-addon-for-beaver-builder/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/powerpack-addon-for-beaver-builder",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-13"
 }
}